EUVD-2026-26131Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain operator.read credentials
-
ExploitSend read-scoped HTTP request via gateway auth route
-
ExecutionGateway widens scope to operator.write
-
ImpactExecute unauthorized runtime write operations
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated session with at least operator.read scope - unauthenticated attackers cannot exploit this flaw. The gateway plugin must be active and configured with |
| Impact | The CVSS 4.0 score of 6.0 with vector AV:N/AC:L/AT:P/PR:L reflects a network-reachable but low-privilege authenticated attack with a specific attack requirement (AT:P), yielding high integrity impact on the vulnerable system and low confidentiality impact. EPSS at 0.05% (16th percentile) and SSVC classifying exploitation as 'none' and automatable as 'no' together indicate very low real-world exploitation probability. The GHSA advisory explicitly scopes the issue to OpenClaw's single-user local assistant trust model, not a multi-tenant service, which meaningfully limits blast radius. SSVC technical impact is rated 'partial', consistent with the CVSS integrity-only impact. Taken together, this is a real but low-urgency authorization flaw - prioritize patching on a normal cycle rather than emergency response. No conflicting signals were identified between sources. |
| Exploit ScenarioDerived | An attacker who holds a valid operator.read credential - such as a restricted API token or delegated read-only access - sends a crafted HTTP request through the gateway auth route. The gateway plugin incorrectly grants operator.write runtime permissions in response, allowing the attacker to modify runtime operations they should only be able to read. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 24, 2026
Privilege escalation in OpenClaw's gateway plugin HTTP authentication mechanism allows an authenticated user with operator.read scope to gain unauthorized operator.write runtime access. The gateway auth route incorrectly widens identity-bearing read-scoped requests into write permissions, bypassing the intended authorization boundary. No active exploitation has been identified (CISA KEV absent), and the vendor has confirmed a patch in version 2026.4.8 of the npm package.
RemediationAI
Upgrade the openclaw npm package to version 2026.4.8 or later, which contains the vendor-confirmed patch (commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5). The fix is documented in the GitHub Security Advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-4f8g-77mw-3rxc and the VulnCheck advisory at https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-gateway-plugin-http-authentication. If immediate upgrade is not possible and the gateway plugin is in use, disabling the auth: gateway HTTP authentication mode on plugin routes would eliminate the vulnerable code path, at the cost of losing gateway-mediated authentication for those routes. No other confirmed workarounds are documented by the vendor.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenClaw (npm package openclaw, CPE: cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*) is a user-controlled local AI assistant. The vulnerability resides in the gateway plugin's HTTP authentication path (auth: gateway), which is responsible for mediating identity and permission scopes between upstream trusted-proxy requests and runtime plugin routes. CWE-863 (Incorrect Authorization) identifies the root cause: the authorization logic fails to enforce scope boundaries, allowing an operator.read credential to be silently elevated to operator.write by the gateway auth handler. Because OpenClaw operates under a single-user trust model rather than a multi-tenant service boundary, the practical blast radius is constrained to the local operator context, but the scope widening still undermines the principle of least privilege within that boundary.
Know when Openclaw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
Network-reachable via gateway HTTP; PR:L because operator.read credentials required; S:U per single-user trust model; I:H for unauthorized write access; C:L for incidental read exposure.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
OpenClaw before 2026.4.8 contains a privilege escalation vulnerability in the gateway plugin HTTP authentication mechanism that widens identity-bearing operator.read requests into runtime operator.write permissions. Attackers can exploit this by sending read-scoped requests through the gateway auth route to gain unauthorized write access to runtime operations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
Authentication bypass in OpenClaw before 2026.5.3 allows remote attackers with low privileges to receive agent responses
Directory-context bypass in OpenClaw before 2026.8.1 allows authenticated attackers with user interaction to reuse an 'a
Unauthenticated access to the noVNC observer interface in OpenClaw's Docker sandbox browser allows anyone who can reach
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
Exploit-DB